EU citizens’ data can be kept for a long time provided that there is sufficient justification. The length of time for which it can be kept is dependent on several varying factors, but no data can be kept indefinitely.

Under GDPR, the right to portability allows individuals to obtain their personal data from any organization that holds it, free of charge. ​When faced with a data portability request from a user, how long do you have to respond?

GDPR recommends 16 as the age of consent for data collection, but allows for member states to set their own, with a hard lower limit of 13 before parental consent is required. So although 16 will be the most commonly adopted age limit, the correct answer by law is 13.